class Netfilter::Packet

Class representing a packet captured by Netfilter::Log.

Public Class Methods

new(nflog, nfad) click to toggle source
# File lib/nflog.rb, line 51
def initialize(nflog, nfad)
    @nflog, @nfad = nflog, nfad
end

Public Instance Methods

data() click to toggle source

The packet contents.

# File lib/nflog.rb, line 146
def data
    hwhdrlen = Log.nflog_get_msg_packet_hwhdrlen(@nfad)
    
    if hwhdrlen > 0
        hwhdr = Log.nflog_get_msg_packet_hwhdr(@nfad)
        link_header = hwhdr.read_bytes(hwhdrlen)
    else
        link_header = ''
    end

    payload_ptr = FFI::MemoryPointer.new(:pointer, 1)
    payload_size = Log.nflog_get_payload(@nfad, payload_ptr)
    if payload_size < 0
        raise LogError, "nflog_get_payload has failed"
    end

    payload = payload_ptr.read_pointer.read_bytes(payload_size)

    [ link_header, payload ]
end
gid() click to toggle source

The GID of the user that generated the packet.

# File lib/nflog.rb, line 216
def gid
    gid = FFI::Buffer.new(FFI.type_size(FFI::Type::UINT32))
    if Log.nflog_get_gid(@nfad, gid) < 0
        return 0 
    end

    gid.read_bytes(gid.total).unpack("I")[0]
end
hw_addr() click to toggle source

The source MAC address.

# File lib/nflog.rb, line 134
def hw_addr
    phw = Log.nflog_get_packet_hw(@nfad)
    return nil if phw.null?

    hw = HardwareAddress.new(phw)
    hw_addrlen = [ hw[:hw_addrlen] ].pack('v').unpack('n')[0]
    hw[:hw_addr].to_ptr.read_bytes(hw_addrlen)
end
indev() click to toggle source

The index of the interface the packet was received through.

# File lib/nflog.rb, line 78
def indev
    Log.nflog_get_indev(@nfad)
end
indev_name() click to toggle source

The name of the interface the packet was received through.

# File lib/nflog.rb, line 85
def indev_name
    get_interface_name(self.indev)
end
nfmark() click to toggle source

The netfilter mark.

# File lib/nflog.rb, line 58
def nfmark
    Log.nflog_get_nfmark(@nfad)
end
outdev() click to toggle source

The index of the interface the packet will be routed to.

# File lib/nflog.rb, line 106
def outdev
    Log.nflog_get_outdev(@nfad)
end
outdev_name() click to toggle source

The name of the interface the packet will be routed to.

# File lib/nflog.rb, line 113
def outdev_name
    get_interface_name(self.outdev)
end
phys_indev() click to toggle source

The index of the physical interface the packet was received through.

# File lib/nflog.rb, line 92
def phys_indev
    Log.nflog_get_physindev(@nfad)
end
phys_indev_name() click to toggle source

The name of the physical interface the packet was received through.

# File lib/nflog.rb, line 99
def phys_indev_name
    get_interface_name(self.phys_indev)
end
phys_outdev() click to toggle source

The index of the physical interface the packet will be routed to.

# File lib/nflog.rb, line 120
def phys_outdev
    Log.nflog_get_physoutdev(@nfad)
end
phys_outdev_name() click to toggle source

The name of the physical interface the packet will be routed to.

# File lib/nflog.rb, line 127
def phys_outdev_name
    get_interface_name(self.phys_outdev)
end
prefix() click to toggle source

The logging string.

# File lib/nflog.rb, line 170
def prefix
    logstr = Log.nflog_get_prefix(@nfad)
    raise LogError, "nflog_get_prefix has failed" if logstr.null?

    logstr.read_string
end
seq() click to toggle source

The NFLOG sequence number.

# File lib/nflog.rb, line 180
def seq
    seqnum = FFI::Buffer.new(FFI.type_size(FFI::Type::UINT32))
    if Log.nflog_get_seq(@nfad, seqnum) < 0
        raise LogError, "nflog_get_seq has failed"
    end

    seqnum.read_bytes(seqnum.total).unpack("I")[0]
end
seq_global() click to toggle source

The global NFLOG sequence number.

# File lib/nflog.rb, line 192
def seq_global
    seqnum = FFI::Buffer.new(FFI.type_size(FFI::Type::UINT32))
    if Log.nflog_get_seq_global(@nfad, seqnum) < 0
        raise LogError, "nflog_get_seq_global has failed"
    end

    seqnum.read_bytes(seqnum.total).unpack("I")[0]
end
timestamp() click to toggle source

The packet timestamp.

# File lib/nflog.rb, line 65
def timestamp
    ptv = FFI::MemoryPointer.new :pointer
    tv = Timeval.new(ptv)
    if Log.nflog_get_timestamp(@nfad, ptv) < 0
        0
    else
        Time.at(tv[:tv_sec])
    end
end
uid() click to toggle source

The UID of the user that generated the packet.

# File lib/nflog.rb, line 204
def uid
    uid = FFI::Buffer.new(FFI.type_size(FFI::Type::UINT32))
    if Log.nflog_get_uid(@nfad, uid) < 0
        return 0
    end

    uid.read_bytes(uid.total).unpack("I")[0]
end

Private Instance Methods

get_interface_name(index) click to toggle source
# File lib/nflog.rb, line 227
def get_interface_name(index)
    iface = @nflog.net_interfaces[index]
    if iface
        iface[:name]
    end
end